Should you trust someone else's vibe-coded app?
I’ve recently vibe-coded several apps: I described what I wanted and iterated with Claude Code. I read the code it wrote, but almost never wrote a line myself.
Since doing so, I’ve come across several other apps that I can tell were created in a similar way. Although they don’t say so explicitly, I can see the tells of Claude’s style. Should I trust them?
On the one hand, all open source software invokes trust; you are running code you didn’t write yourself. Since AI agents are generally made to block “nefarious” requests, does that make them more safe?
On the other hand, should I be more wary that “no one was at the helm”? Vibe-coding moves the responsibility for safe and secure implementation details to the AI model. The author may not understand (or read) every line, may have accepted plausible-looking code that leaks secrets, mishandles permissions, or introduces subtle bugs that pass tests but fail in edge cases. Agents also copy boilerplate with hidden dependencies, inject credentials into logs, and tend to produce code that works for the demo but lacks defensive boundaries.
With open source I can at least read it, run static analysis, and audit the build. That helps, but auditing AI-generated code is harder than trusting a human expert on a piece of software to do it. The bar for trust remains the same as with any software, even if the process that created it feels different. You probably want to run software from an organization that you trust, not random individuals.
